External risk intelligence

Adobe Experience Manager Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-113580

Adobe Experience Manager is a web content management system designed to serve public-facing websites, digital experiences, and web applications. Given its function as a web-accessible platform, it is commonly deployed as an internet-facing application, making the underlying service surface reachable from the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Experience Manager, a platform for digital experiences, has a critical vulnerability that allows unauthorized code execution. This issue could enable attackers with limited privileges to run malicious code remotely, potentially impacting system integrity. The main concern is confirming if our Adobe Experience Manager instances are affected and assessing the exposure.

Uncontrolled code generation enables unauthorized execution.
Critical flaw affects a widely used digital experience platform.
Confirm exposure and relevance to our Adobe Experience Manager.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could exploit this vulnerability by sending specially crafted requests to Adobe Experience Manager. Because the issue impacts code generation, successful exploitation allows an attacker to execute arbitrary code on the system, potentially leading to a complete compromise. The vulnerability can be triggered without any user interaction and has a changed scope, indicating a significant potential impact.

Entry condition: Low-privileged attacker access.
Trigger point: Improper code generation.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a low-privileged attacker to execute arbitrary code on a system running Adobe Experience Manager. This could affect the integrity and availability of the affected system and potentially lead to unauthorized access or modification of data, depending on the privileges of the user context.

System code execution.
Network-based code injection.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders and system owners should prioritize identifying all instances of Adobe Experience Manager, confirm their exposure and criticality, and then work with application or platform teams to plan remediation. The first practical step is to locate affected systems, assess their business impact and reachability, and assign ownership for subsequent actions.

Application owners and platform teams should lead remediation.
Verify Adobe Experience Manager's exposure and criticality.
Plan and coordinate vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Experience Manager?

Adobe Experience Manager is a comprehensive content management system used by organizations to build, manage, and deliver digital experiences, public-facing websites, and complex web applications. It serves as a central hub for digital assets and site architecture, often acting as the foundation for an organization's public web presence.

What does the code injection vulnerability in CVE-2026-113580 mean?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). It means the software does not properly filter or handle data used to create system instructions. Because of this flaw, a low-privileged attacker can inject their own malicious commands, forcing the application to execute unintended code with the permissions of the current user.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted requests to the application. This process does not require any interaction from other system users to succeed. It is important to note that the vulnerability relies on the ability to interact with the system's code generation processes; it is not triggered by simple legitimate navigation of the site.

Is my instance at risk if it is internal?

Halo Surface Signal notes that Adobe Experience Manager is typically deployed as an internet-facing application to support public websites. While internet-facing instances have the highest risk of being reachable by remote attackers, any instance where a low-privileged account could send these requests is potentially affected, regardless of whether it is segmented internally.

What should I do first to respond to this threat?

Your first step is to inventory your environment to locate all running instances of Adobe Experience Manager. Once identified, evaluate the criticality of each instance based on its function and connectivity. Assign clear ownership to application and platform teams so they can prepare for vendor-supplied security updates or configuration changes.

References

www.adobe.com/trust/security/products/experience-manager/apsb26-189…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.